src/sbom: push for further CRA compliance

[filipleple]

Upstream-Status: Pending

[filipleple]

Got down to 0 errors for CRA compliance. sbom-tools validate --standard cra, before and after the changes from this PR:

 λ diff cra-validate.log cra-validate_afterfixes.log
flewinski in ~/workspace/sbom-iter2/coreboot on sbom_iter2 ● λ cd ..
flewinski in ~/workspace/sbom-iter2 λ diff cra-validate.log cra-validate_afterfixes.log
1,2c1,2
< 2026-07-10T07:46:05.786632Z  INFO Parsing SBOM: "artifacts/novacustom/nuc_box_mtl/coreboot/uefi/v0.9.2-rc4/novacustom_nuc_box_mtl_v0.
< 2026-07-10T07:46:05.787097Z  INFO Parsed 8 components
---
> 2026-07-10T10:51:07.640691Z  INFO Parsing SBOM: "novacustom_nuc_box_v0.9.2-rc4.sbom.json"
> 2026-07-10T10:51:07.641108Z  INFO Parsed 8 components
4c4
< Status: NON-COMPLIANT (1 errors, 5 warnings, 16 info)
---
> Status: COMPLIANT (0 errors, 5 warnings, 11 info)
20,29d19
< [INFO] Integrity Information | CRA Annex I: Component integrity information (hash) | Intel Management Engine
<   [CRA Annex I] Component 'Intel Management Engine' missing cryptographic hash (recommended for integrity)
< [INFO] Integrity Information | CRA Annex I: Component integrity information (hash) | edk2
<   [CRA Annex I] Component 'edk2' missing cryptographic hash (recommended for integrity)
< [INFO] Integrity Information | CRA Annex I: Component integrity information (hash) | Intel-Microcode
<   [CRA Annex I] Component 'Intel-Microcode' missing cryptographic hash (recommended for integrity)
< [INFO] Integrity Information | CRA Annex I: Component integrity information (hash) | Intel Firmware Support Package
<   [CRA Annex I] Component 'Intel Firmware Support Package' missing cryptographic hash (recommended for integrity)
< [INFO] Integrity Information | CRA Annex I: Component integrity information (hash) | Intel Flash Descriptor
<   [CRA Annex I] Component 'Intel Flash Descriptor' missing cryptographic hash (recommended for integrity)
34,35d23
< [WARN] License Information | CRA Art. 13(5): Licensed component tracking | -
<   [CRA Art. 13(5)] 7/8 components (87%) missing license information
38,39c26,27
< [ERROR] Integrity Information | CRA Annex I Part II / prEN 40000-1-3 [PRE-7-RQ-07-RE]: Vendor hash carry-through | -
<   [CRA Annex I, Part II / [PRE-7-RQ-07-RE]] Only 0/8 vendor-supplied components (0%) carry an upstream hash — below 50% threshold
---
> [WARN] Integrity Information | CRA Annex I Part II / prEN 40000-1-3 [PRE-7-RQ-07-RE]: Vendor hash carry-through | -
>   [CRA Annex I, Part II / [PRE-7-RQ-07-RE]] Only 5/8 vendor-supplied components (63%) carry an upstream hash — below 80% threshold

[philipanda]

LVFS does not detect the SBOM in the binary built from this branch. Uploaded to embargo.

I'm still getting no hash for FSP-S.

I've built the firmware for nv41mz with this diff:

git diff                   
diff --git a/configs/config.novacustom_nv4x_tgl b/configs/config.novacustom_nv4x_tgl
index 327a07357d92..10230b3bfaf9 100644
--- a/configs/config.novacustom_nv4x_tgl
+++ b/configs/config.novacustom_nv4x_tgl
@@ -1,5 +1,16 @@
 CONFIG_LOCALVERSION="v1.6.0-rc2"
 CONFIG_OPTION_BACKEND_NONE=y
+CONFIG_SBOM=y
+CONFIG_SBOM_PAYLOAD=y
+CONFIG_SBOM_ME=y
+CONFIG_SBOM_EC=y
+CONFIG_SBOM_SINIT_ACM=y
+CONFIG_SBOM_BIOS_ACM=y
+CONFIG_SBOM_INTEL_MICROCODE=y
+CONFIG_SBOM_INTEL_FSP=y
+CONFIG_SBOM_IFD=y
+CONFIG_SBOM_VBOOT=y
+CONFIG_SBOM_IPXE=y
 CONFIG_VENDOR_NOVACUSTOM=y
 CONFIG_FMDFILE="src/mainboard/clevo/tgl-u/vboot-rwa.fmd"
 # CONFIG_CONSOLE_SERIAL is not set

and ./build.sh nv4x_tgl

And using the reproduction steps from Dasharo/dasharo-issues#1878, I get:

(dasharo) fgolas in ~/3mdeb/lvfs-website on tags/1.5.2 ● ● λ uv run lvfs_sbom_check.py ../coreboot2/clevo_tgl_u_v1.6.0-rc2.cab
Traceback (most recent call last):
  File "/home/fgolas/3mdeb/lvfs-website/lvfs_sbom_check.py", line 8, in <module>
    for c in uSwidFormatUswid().load(b):
             ~~~~~~~~~~~~~~~~~~~~~~~^^^
  File "/home/fgolas/3mdeb/dasharo/.venv/lib/python3.13/site-packages/uswid/format_uswid.py", line 64, in load
    offset += self._load_bytes(container, blob, offset)
              ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/fgolas/3mdeb/dasharo/.venv/lib/python3.13/site-packages/uswid/format_uswid.py", line 187, in _load_bytes
    payload_offset += self._fmt()._load_component(
                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        component, payload, payload_offset
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/home/fgolas/3mdeb/dasharo/.venv/lib/python3.13/site-packages/uswid/format_coswid.py", line 496, in _load_component
    component.add_payload(payload)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/home/fgolas/3mdeb/dasharo/.venv/lib/python3.13/site-packages/uswid/component.py", line 386, in add_payload
    raise NotSupportedError(
        f"the hash value MUST be provided for {str(payload)}"
    )
uswid.errors.NotSupportedError: the hash value MUST be provided for uSwidPayload(name="FSP-S",size=None)

[filipleple]

@philipanda fixed the hashing and backported yout TGL SBOM fixes. Now nv4x_tgl built from this rev passes Phase 2 compliance:

and the LVFS check goes through without erroring out. It's reporting missing info, e.g. about compiler used per component, but SBOM detection itself should now be succesful:

 λ uv run lvfs_sbom_check.py $artifacts_dir/novacustom_nv4x_tgl_v1.6.0-rc2.cab
('a9032c9d-2aaa-5a25-a0e6-6d865b24e6d2',
 [],
 ['uSwidProblem(kind=entity, description="No regid", since="0.4.7"))',
  'uSwidProblem(kind=link, description="Has no COMPILER", since="0.4.7"))'])
('9579af2b-39d8-59f1-ac5a-5b1fd4c03bd0',

(...)

  'since="0.4.7"))'])
('7d6f330b-8561-54ac-b507-a143b12e1d32',
 [],
 ['uSwidProblem(kind=entity, description="No entity marked as '
  'SoftwareCreator", since="0.4.7"))'])
λ

[filipleple]

Removed the test configs temporary commit. If anyone wishes to reproduce, here's the patch:
test.patch

Here are example sboms generated with the patches, building from dasharo-builder, all reaching 0 errors on both Phase 1 and Phase 2 of CRA in sbom-tools:

novacustom_nuc_box_mtl_v0.9.2.sbom.json
novacustom_nv4x_tgl_v1.6.0-rc2.sbom.json
novacustom_v56x_mtl_igpu_v1.0.2-rc1.sbom.json
protectli_ap2110_v0.9.0-rc2.sbom.json

λ for sbom in $(find artifacts/ -type f -name '*.sbom.json'); do
    sbom-tools validate --standard cra "$sbom" | grep error -i
done
Status: COMPLIANT (0 errors, 4 warnings, 9 info)
Status: COMPLIANT (0 errors, 5 warnings, 12 info)
Status: COMPLIANT (0 errors, 4 warnings, 10 info)
Status: COMPLIANT (0 errors, 4 warnings, 9 info)

They also return no errors on the LVFS check, so their SBOMs should be detected correctly:

λ for cab in $(find artifacts/ -type f -name '*.cab'); do 
    uv run lvfs_sbom_check.py "$cab"
done
('a9032c9d-2aaa-5a25-a0e6-6d865b24e6d2',
 [],
 ['uSwidProblem(kind=entity, description="No regid", since="0.4.7"))',
  'uSwidProblem(kind=link, description="Has no COMPILER", since=

(...)

λ for cab in $(find artifacts/ -type f -name '*.cab'); do
    uv run lvfs_sbom_check.py "$cab" | grep error -i
done
λ